IPv4 vs IPv6, Explained

IPv4 vs IPv6: Two Address Systems, One Internet

Every packet that crosses the internet carries a source and destination address written in one of two formats. IPv4, standardised in 1981, uses 32-bit addresses. IPv6, its successor, uses 128 bits. The ipv4 vs ipv6 question is not really a rivalry — both protocols run side by side on most modern networks — but the differences matter for anyone reading logs, running a lookup, or trying to understand what an address can and cannot tell you.

Notation: dotted quads and hex groups

An IPv4 address is four decimal numbers between 0 and 255, separated by dots — the familiar dotted quad, such as 8.8.8.8 (you can inspect that one in an example trace). Four bytes, roughly 4.3 billion possible values.

IPv6 writes its 128 bits as eight groups of four hexadecimal digits separated by colons: 2001:0db8:0000:0000:0000:0000:0000:0001. Because addresses that long are unwieldy, the notation allows two shortcuts. Leading zeros in each group can be dropped, and one — and only one — run of consecutive all-zero groups can be collapsed to a double colon. The address above compresses to 2001:db8::1. The canonical rules for this compression are set out in RFC 5952; following them matters, because the same address can otherwise be written a dozen ways, which plays havoc with log searches and blocklists.

The exhaustion story

IPv4's 4.3 billion addresses seemed inexhaustible in 1981. They were not. IANA handed out its last free blocks to the regional internet registries in 2011, and the registries themselves — including RIPE NCC, which declared its pool exhausted in 2019 — now allocate IPv4 only from returned or reclaimed space. A market for used address blocks exists, with prices per address that would have baffled the protocol's designers.

IPv6 was built so this could never happen again. Its address space holds 2^128 values — about 340 undecillion, a 39-digit number. The design is deliberately profligate: a typical home connection receives a /64 prefix containing more addresses than the entire IPv4 internet, squared. The intent is that address scarcity should never again shape how networks are built.

NAT and CGNAT: IPv4 on life support

The reason IPv4 still works despite exhaustion is Network Address Translation. Your home router holds one public IPv4 address and translates for every device behind it, which is why your laptop's 192.168.x.x address never appears on the public internet — only the router's address does, which is what What Is My IP reports.

Many carriers now add a second layer: Carrier-Grade NAT, where hundreds or thousands of subscribers share a single public IPv4 address. CGNAT keeps the addresses flowing, but it degrades the meaning of an IPv4 address as an identifier. Traffic from one CGNAT address may represent thousands of unrelated households, and no individual among them can be singled out from the address alone. This is one of several reasons IP geolocation cannot identify a person — a point covered in depth in Can someone find my address from my IP?

Dual-stack reality

The transition plan was never a flag day; it was coexistence. Most modern devices run dual-stack — an IPv4 and an IPv6 address simultaneously — and prefer IPv6 when a destination offers it. Global IPv6 adoption now accounts for well over a third of traffic to major services, but the distribution is uneven: strong on mobile carriers and large consumer ISPs, weak on older enterprise networks. Practically, this means the same connection may appear in your logs under two entirely different addresses depending on which protocol a given session negotiated.

What changes for geolocation and tracing

For network forensics, the protocols age differently. IPv4 space has been allocated, traded, and observed for four decades, so geolocation databases such as DB-IP have deep, well-corroborated evidence for most blocks. IPv6 blocks are newer and vastly sparser — a single /32 allocation to an ISP dwarfs the entire IPv4 internet — so location evidence is thinner and confidence ratings run lower, especially below country level. A trace on either protocol yields an approximate region, never a pinpoint; see how accurate IP geolocation is for honest numbers.

IPv6 also changes client behaviour. Privacy extensions, defined in RFC 8981, rotate the interface-identifier half of the address regularly, so a device's full 128-bit address changes daily or per-connection even while its /64 prefix stays put. For tracing, the prefix is the stable signal; the low bits are noise by design. Routing context is unchanged in either protocol: the announcing autonomous system still tells you which operator carries the traffic, and an ASN lookup works identically for both.

One thing the version number does not change: an address of either protocol locates network infrastructure, not people. A trace yields a probable area and an operator, each with a confidence rating — nothing that identifies an individual. To see what each protocol actually reveals about your own connection, run a trace and compare the dossiers.